CVE-2025-4760
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
| Software | From | Fixed in |
|---|---|---|
org.wso2.carbon.apimgt / org.wso2.carbon.apimgt.api
|
- | 9.31.117 |
|
org.wso2.carbon.apimgt / org.wso2.carbon.apimgt.rest.api.publisher.v1
|
- | 9.31.117 |
| wso2 / api_control_plane | 4.5.0 | 4.5.0.x |
| wso2 / api_manager | 3.2.0 | 3.2.0.x |
| wso2 / api_manager | 3.2.1 | 3.2.1.x |
| wso2 / api_manager | 4.1.0 | 4.1.0.x |
| wso2 / api_manager | 4.2.0 | 4.2.0.x |
| wso2 / api_manager | 4.3.0 | 4.3.0.x |
| wso2 / api_manager | 4.4.0 | 4.4.0.x |
| wso2 / api_manager | 4.5.0 | 4.5.0.x |
| wso2 / traffic_manager | 4.5.0 | 4.5.0.x |
| wso2 / universal_gateway | 4.5.0 | 4.5.0.x |
- https://github.com/wso2/carbon-apimgt/commit/1b3496c072ec68aaaf726996e2caa76f07c1adca
- https://github.com/wso2/carbon-apimgt/pull/13099
- https://mvnrepository.com/artifact/org.wso2.carbon.apimgt/org.wso2.carbon.apimgt.api/9.31.117
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104/
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime